From: Hajeski, Susi T. (BA) (FBI) ■■■■[ 

Sent: Monday, May 06, 2019 12:10 PM EDI 

To: Guilford, Gayle <Gayle.Guilford@baltimorecity.gov> 

CC: Guynn, Robert E. (BA) (FBI) Perrino, Joseph (BA) (FBI) 

Subject: Thank you and Questions 

Hi Gayle, 

Thank you so much for hosting me a couple weeks ago. 

Now that the dust has settled, the agents working this investigation have been asking about data your folks were collecting. 

When Joe Perrino and I left your office on April 25th, there were some logs and other data, specific to the individuals named in the search warrants, that 
your people had not yet produced. 

Could you tell me if your people are still working on compiling data for the FBI? Were you waiting for additional legal process from the United States 
Attorney's Office regarding this data? 

The Assistant United States Attorney for this case believes the search warrants provided to you on April 25,2019 are still valid for the items we were 
unable to collect that day. 

I have a list of specific data sets I requested from you and several that I discussed with Ron. Below is the list of items which we were looking to obtain 
from your office but did not collect on that day. 

Could you let me know if you have some or all of the items below set aside for the FBI? If the items have not been collected, how much time is needed to 
compile these data sets? 

The requested data should only be in reference to Catherine Pugh and Gary Brown Jr., per the two search warrants provided on April 25, 2019. 

- Active Directory (AD) and Windows User Authentication Logs for the two individuals 

- Cisco AnyConnect VPN, legacy iSpec VPN, 7206 VPN Concentrator, or other remote access logs for the two individuals 

- Files created, modified and/or deleted on the "City Hair share drive for the two individuals 

- Backups of the user profiles for the two individuals and their devices, which your office refers to as 'Shadow Copies', prior to April 8, 2019 

- Files deleted from the profiles by the two individuals which may be contained in a network server "Recovery Bin" 

These data sets in addition to the internal hard drive from the computer in the Mayor's Office are what the agents are looking to obtain under the current 
search warrants. 

Please feel free to contact me if you have any questions. 

Susi Hajeski 

Senior Computer Scientist 
FBI Baltimore Field Office 




AO 93 (Rev. 11/13) Search and Seizure Warrant 


United States District Court 

for the 

District of Maryland 

In the Matter of the Search of 

(Briefly describe the property to be searched 
or identify the person by name and address) 

Baltimore City Hall, Room 250 
100 N. Holliday Street 
Baltimore, MD 21202 

SEARCH AND SEIZURE WARRANT 

To: Any authorized law enforcement officer 

An application by a federal law enforcement officer or an attorney for the government requests the search 
of the following person or property located in the _ District of _ Maryland 

(identify the person or describe the property to be searched and give its location)'. 

See Attachment A-5 which is attached hereto and incorporated herein by reference. 



I find that the affidavit(s), or any recorded testimony, establish probable cause to search and seize die person or property 
described above, and that such search will reveal (identify the person or describe the property to be seized) : 

See Attachment B-5 which is attached hereto and incorporated herein by reference. 


Ypi 


Ml 


YpU ARE COMMANDED to execute this warrant on or before ^ &// f _ (not to exceed 14 days) 

m the daytime 6:00 a.m. to 10:00 p.m. □ at any time in the day or nighfoec/use good causa bag been 


Unless delayed notice is authorized below, you must give a copy of the warrant and a receipt for the property faWn to die 
person from whom, or from whose premises, the property was taken, or leave the copy and receipt at the place where the 
property was taken. 

The officer executing this warrant, or an officer present during the execution of the warrant, must prepare an inventory 

as required by law and prompdy return this warrant and inventory to_ Duty Magistrate Judge _. 

(United States Magistrate Judge) 

/$Pursuant to 18 U.S.C. § 3103a(b), I find that immediate notification may have an adverse result listed in 18 U.S.C. 

§ 2705 (except for delay of trial), and authorize the officer executing this warrant to delay notice to the person who, or whose 
property, will be searched or seized (check the appropriate box) . 

a for_days (not to exceed 30) JSnmtil, the facts justifying, the later specific date of 

. fifth /jMf ' 

Date and time issued: j <y 

^Judge's signature 


City and state: 


Baltimore, Maryland 


/ Kludge 's signature 

'Mark Coulson, U,S. Magistrate Judge 
Printed name and title 






AO 93 (Rev. 11/13) Search and Seizure Warrant 


United States District Court 

for the 

District of Maryland 

In the Matter of the Search of ) 

(Briefly describe the property to be searched ) 19 -14 6 9 JMO 

or identify the person by name and address) ) Case No. 

100 Holliday Street, 2nd Floor, Baltimore, Maryland ) 

21202 ) 

) 

SEARCH AND SEIZURE WARRANT 

To: Any authorized law enforcement officer 

An application by a federal law enforcement officer or an attorney for the government requests the search 
of the following person or property located in the_District of Maryland 

(identify the person or describe the property to be searched and give Us location): 

See attachment A8 which is attached hereto and incorporated herein by reference. 


I find that the affidavits), or any recorded testimony, establish probable cause to search and seize the person or property 
described above, and that such search will reveal (identify the person or describe the property to be seized): 

See attachment B8 which is attached hereto and incorporated herein by reference. 


YpU ARE COMMANDED to execute this warrant on or before .S'P'b /// 

&m the daytime 6:00 a.m. to 10:00 p.m. □ at any time in the day or nightb/caufe good cause has been established. 


_ (not to exceed 14 days) 


Unless delayed notice is authorized below, you must give a copy of the warrant and a receipt for the property taken to the 
person from whom, or from whose premises, the property was taken, or leave the copy and receipt at the place where the 
property was taken. 

The officer executing this warrant, or an officer present during the execution of the warrant; must prepare an inventory 

as required by law and promptly return this warrant and inventory to __ Duly Magistrate Judge _ 

TOW (United States Magistrate Judge) 

Pursuant to 18 U.S.C. § 3103a(b), I find that immediate notification may have an adverse result listed in 18 U.S.C. 

§ 2705 (except for delay of trial), and authqri» the officer executing this warrant to delay notice to the person who, or whose 
property, will be searched or seized (check the appropriate box) 

□ for_days (not to exceed 30) J urtil^fo^facts justifying, the later specific date of 

Date and time issued: 


City and state: 





Baltimore, Maryland 



Judge ’^signature 

J. MaglfCoulson, United States Magistrate Judge 


Printed name and Me 






FD-597 (Rev 4-13-2015) 


UNITED STATES DEPARTMENT OF JUSTICE 
FEDERAL BUREAU OF INVESTIGATION 
Receipt for Property 


Case ID 


Ml ftrt - 9 Hi')loo 

On (date) ^ I f ) S / Qol^ 


item (s) listed below were: 
Pi Collected/Seized 
□ Received From 

B Returned To 
Released To 


(Name) (V'Wll CnA (1 {pY < J _ 

(Street Address) Lti) \ [ V (C-i ( C ^ V ^ 7-^ & f | 

(City) (h.\ t I )V U ■■. t t . it/l D ) (V> _ 













FD-597 (Rev. 4-13-2015) 


Page 1 of ... 


UNITED STATES DEPARTMENT OF JUSTICE 
FEDERAL BUREAU OF INVESTIGATION 
Receipt for Property 


Case ID: 


: iyl f - Pa - 7^0100 

On (date) \ [ ■■ ■ _ 


(Name) 


f\!\ fU fli t I i ^ ' ^ 


item (s) listed below were: 
□ Collected/Seized 
O Received From 

B Returned To 
Released To 


(StreetAddress) I r . t/i iliK {\g\Y 

(City) i I [ UAJJUI , 1/1(1 ) ) l 


Description of Item (s): ___ A __ , _ 

t.\j i~i.{ , *i i iA/ni ,/> \\V % . ./< >,\A Vj\ S-V-fn j'i<\ ..■,., /A',)/}I-, 


¥ t \ i 11 i . - i 


i 




11 , ‘ i-i c A 1 f\ . 


j 



Received By: 


L/ 

Printed Name/Title: 




0 


signature) 


K,< i#1 |^Vr.,t-0/ 


C A 
- = ! 


Received From: 


t/ 


Printed NameyTitle: 


• & Li 


(Signature) 

a 


X 




/i 




;. 
f+-€> 







FD-597 (Rev. 4-13-2015) 


Page / of_ / 


UNITED STATES DEPARTMENT OF JUSTICE 
FEDERAL BUREAU OF INVESTIGATION 
Receipt for Property 


Case ID: _ 

On (date) 


(Name) _ 

(Street Address) 
(City) _ 


S l £-/9 


<//c _ d 


item (s) listed below were: 
ET’ Collected/Seized 
I 1 Received From 

B Returned To 
Released To 


4 'OjL £_ , J ^ /^/oor 

j &£ tSlA&k _ 


Description of Item (s): 2H1 _ Soa^rA<t rffcC/C //si r c/t/rt SpffC*/ /)c/r>£f> r 

__ 

_ <2/2. S. Sxs/T jZ.C £— f Tj/ut./. /r\ s'ct/orS(?/ /<g</ Q/m jOjc. Q V 3. 5" V 

_ t+ s'^A _ QjUs . _ 6/&/JSC. jOot^jer q!xz*£2jl _ 





